Controls
Keep what you must. Dispose of what you may. Show the decision.
A record has two duties that pull against each other: to be there when someone asks, and to be gone when the law says it should be. Stamped HR holds both and records the decision.
Each record carries its own clock.
- 01
A reason to keep it
Every kind of record is tied to the reason it is kept and how long that reason requires. The periods are set centrally, not by whoever is entering the record.
- 02
A deletion date
The clock starts when something happens, such as a job ending, and the date is worked out for you.
- 03
A hold stops it
A legal hold, for a stated reason from a closed list, keeps a record out of any disposal until it is released.
- 04
A list, not a surprise
A nightly job lists records past their date and not held, and workers who would have nothing left.
Disposal needs two people.
- Two different people, each holding the approval permission, approve a proposal, each from a session that proved a second factor.
- The second approval checks everything again: retention, holds and every entry on the list. Anything that has changed since the proposal is left out.
- A disposed record keeps its row as a note that it existed and when it was disposed of; its content is removed, and its files are removed from storage.
- When a worker has nothing left to keep, their encryption key is destroyed, which is what makes any remaining copies unreadable, including in backups.
Built, and not yet switched on
Disposal is built and tested, and it is off. The retention periods have to be confirmed by the right specialist for each kind of record, such as payroll or data protection, before anything can be disposed of. Until then no record is removed, whatever its age. We would rather say that than describe a control as live that is waiting on a decision.
See the controls on a real record.
Bring one worker file and we will show who could see it, how long it is kept and what leaves the system when it is asked for.